Skip to content

Commit 5296524

Browse files
fabriziosestitofabriziosestito
committed
ci: harden run blocks against template injection
Signed-off-by: Fabrizio Sestito <fabrizio.sestito@suse.com>
1 parent 2bb92c8 commit 5296524

3 files changed

Lines changed: 33 additions & 22 deletions

File tree

‎.github/workflows/attestation.yml‎

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ jobs:
2020
env:
2121
CRANE_VERSION: v0.20.5
2222
CRANE_CHECKSUM: ad4cd9af2568c62c97e346de6d1295ee8c6ce3341f7b71cf02d41292b4532680
23+
COMPONENT: ${{ inputs.component }}
24+
ARCH: ${{ inputs.arch }}
25+
GH_REF: ${{ github.ref }}
2326

2427
steps:
2528
- name: Install cosign
@@ -50,28 +53,28 @@ jobs:
5053
working-directory: ${{ runner.temp }}/digests
5154
run: |
5255
set -e
53-
DIGEST=$(cat ${{ inputs.component }}-${{ inputs.arch }}.txt)
56+
DIGEST=$(cat "${COMPONENT}-${ARCH}.txt")
5457
echo "DIGEST=${DIGEST}" >> "$GITHUB_ENV"
5558
- name: Find attestation digest
5659
run: |
5760
set -e
58-
DIGEST=$(crane manifest ghcr.io/${{ github.repository_owner }}/sbomscanner/${{ inputs.component }}@${{ env.DIGEST }} \
61+
DIGEST=$(crane manifest "ghcr.io/${{ github.repository_owner }}/sbomscanner/${COMPONENT}@${DIGEST}" \
5962
| jq -r '.manifests[]
6063
| select(.annotations["vnd.docker.reference.type"] == "attestation-manifest")
6164
| .digest')
6265
echo "ATTESTATION_MANIFEST_DIGEST=${DIGEST}" >> "$GITHUB_ENV"
6366
- name: Find provenance manifest digest
6467
run: |
6568
set -e
66-
DIGEST=$(crane manifest ghcr.io/${{ github.repository_owner }}/sbomscanner/${{ inputs.component }}@${{ env.ATTESTATION_MANIFEST_DIGEST }} |
69+
DIGEST=$(crane manifest "ghcr.io/${{ github.repository_owner }}/sbomscanner/${COMPONENT}@${ATTESTATION_MANIFEST_DIGEST}" |
6770
jq -r '.layers[]
6871
| select(.annotations["in-toto.io/predicate-type"] == "https://slsa.dev/provenance/v1")
6972
| .digest')
7073
echo "PROVENANCE_DIGEST=${DIGEST}" >> "$GITHUB_ENV"
7174
- name: Find SBOM manifest layer digest
7275
run: |
7376
set -e
74-
DIGEST=$(crane manifest ghcr.io/${{github.repository_owner}}/sbomscanner/${{ inputs.component }}@${{ env.ATTESTATION_MANIFEST_DIGEST}} | \
77+
DIGEST=$(crane manifest "ghcr.io/${{github.repository_owner}}/sbomscanner/${COMPONENT}@${ATTESTATION_MANIFEST_DIGEST}" | \
7578
jq '.layers | map(select(.annotations["in-toto.io/predicate-type"] == "https://spdx.dev/Document")) | map(.digest) | join(" ")')
7679
echo "SBOM_DIGEST=${DIGEST}" >> "$GITHUB_ENV"
7780
@@ -81,30 +84,30 @@ jobs:
8184
- name: Download provenance and SBOM files
8285
run: |
8386
set -e
84-
crane blob ghcr.io/${{github.repository_owner}}/sbomscanner/${{ inputs.component }}@${{ env.PROVENANCE_DIGEST}} \
85-
> SBOMscanner-${{ inputs.component }}-attestation-${{ inputs.arch }}-provenance.intoto.jsonl
86-
crane blob ghcr.io/${{github.repository_owner}}/sbomscanner/${{ inputs.component }}@${{ env.SBOM_DIGEST}} \
87-
> SBOMscanner-${{ inputs.component }}-attestation-${{ inputs.arch }}-sbom.json
87+
crane blob "ghcr.io/${{github.repository_owner}}/sbomscanner/${COMPONENT}@${PROVENANCE_DIGEST}" \
88+
> "SBOMscanner-${COMPONENT}-attestation-${ARCH}-provenance.intoto.jsonl"
89+
crane blob "ghcr.io/${{github.repository_owner}}/sbomscanner/${COMPONENT}@${SBOM_DIGEST}" \
90+
> "SBOMscanner-${COMPONENT}-attestation-${ARCH}-sbom.json"
8891
- name: Sign provenance and SBOM files
8992
run: |
9093
set -e
9194
cosign sign-blob --yes \
92-
--bundle SBOMscanner-${{ inputs.component }}-attestation-${{ inputs.arch }}-provenance.intoto.jsonl.bundle.sigstore \
93-
SBOMscanner-${{ inputs.component }}-attestation-${{ inputs.arch }}-provenance.intoto.jsonl
95+
--bundle "SBOMscanner-${COMPONENT}-attestation-${ARCH}-provenance.intoto.jsonl.bundle.sigstore" \
96+
"SBOMscanner-${COMPONENT}-attestation-${ARCH}-provenance.intoto.jsonl"
9497
cosign verify-blob \
95-
--bundle SBOMscanner-${{ inputs.component }}-attestation-${{ inputs.arch }}-provenance.intoto.jsonl.bundle.sigstore \
98+
--bundle "SBOMscanner-${COMPONENT}-attestation-${ARCH}-provenance.intoto.jsonl.bundle.sigstore" \
9699
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
97-
--certificate-identity="https://github.com/${{github.repository_owner}}/sbomscanner/.github/workflows/attestation.yml@${{ github.ref }}" \
98-
SBOMscanner-${{ inputs.component }}-attestation-${{ inputs.arch }}-provenance.intoto.jsonl
100+
--certificate-identity="https://github.com/${{github.repository_owner}}/sbomscanner/.github/workflows/attestation.yml@${GH_REF}" \
101+
"SBOMscanner-${COMPONENT}-attestation-${ARCH}-provenance.intoto.jsonl"
99102
100103
cosign sign-blob --yes \
101-
--bundle SBOMscanner-${{ inputs.component }}-attestation-${{ inputs.arch }}-sbom.json.bundle.sigstore \
102-
SBOMscanner-${{ inputs.component }}-attestation-${{ inputs.arch }}-sbom.json
104+
--bundle "SBOMscanner-${COMPONENT}-attestation-${ARCH}-sbom.json.bundle.sigstore" \
105+
"SBOMscanner-${COMPONENT}-attestation-${ARCH}-sbom.json"
103106
cosign verify-blob \
104-
--bundle SBOMscanner-${{ inputs.component }}-attestation-${{ inputs.arch }}-sbom.json.bundle.sigstore \
107+
--bundle "SBOMscanner-${COMPONENT}-attestation-${ARCH}-sbom.json.bundle.sigstore" \
105108
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
106-
--certificate-identity="https://github.com/${{github.repository_owner}}/sbomscanner/.github/workflows/attestation.yml@${{ github.ref }}" \
107-
SBOMscanner-${{ inputs.component }}-attestation-${{ inputs.arch }}-sbom.json
109+
--certificate-identity="https://github.com/${{github.repository_owner}}/sbomscanner/.github/workflows/attestation.yml@${GH_REF}" \
110+
"SBOMscanner-${COMPONENT}-attestation-${ARCH}-sbom.json"
108111
109112
- name: Upload SBOMs as artifacts
110113
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

‎.github/workflows/container-build.yml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -72,10 +72,12 @@ jobs:
7272
ghcr.io/${{ github.repository_owner }}/sbomscanner/${{ matrix.component }}@${{ steps.build-image.outputs.digest }}
7373
7474
- name: Verify container image signature
75+
env:
76+
GH_REF: ${{ github.ref }}
7577
run: |
7678
cosign verify \
7779
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
78-
--certificate-identity="https://github.com/${{github.repository_owner}}/sbomscanner/.github/workflows/container-build.yml@${{ github.ref }}" \
80+
--certificate-identity="https://github.com/${{github.repository_owner}}/sbomscanner/.github/workflows/container-build.yml@${GH_REF}" \
7981
ghcr.io/${{ github.repository_owner }}/sbomscanner/${{ matrix.component }}@${{ steps.build-image.outputs.digest }}
8082
8183
- name: Export digest
@@ -127,8 +129,10 @@ jobs:
127129
128130
- name: Retrieve tag name (release)
129131
if: ${{ !startsWith(github.ref, 'refs/heads/main') }}
132+
env:
133+
VERSION: ${{ inputs.version }}
130134
run: |
131-
echo TAG_NAME=${{ inputs.version }} >> $GITHUB_ENV
135+
echo "TAG_NAME=${VERSION}" >> "$GITHUB_ENV"
132136
133137
- name: Create and push multi-arch manifest for ${{ matrix.component }}
134138
id: create-manifest
@@ -182,10 +186,12 @@ jobs:
182186
echo "MULTI_ARCH_MANIFEST_DIGEST=$multi_arch_manifest_digest" >> $GITHUB_ENV
183187
184188
- name: Verify multi-arch manifest signature
189+
env:
190+
GH_REF: ${{ github.ref }}
185191
run: |
186192
cosign verify \
187193
--certificate-oidc-issuer=https://token.actions.githubusercontent.com \
188-
--certificate-identity="https://github.com/${{github.repository_owner}}/sbomscanner/.github/workflows/container-build.yml@${{ github.ref }}" \
194+
--certificate-identity="https://github.com/${{github.repository_owner}}/sbomscanner/.github/workflows/container-build.yml@${GH_REF}" \
189195
ghcr.io/${{ github.repository_owner }}/sbomscanner/${{ matrix.component }}@${{ env.MULTI_ARCH_MANIFEST_DIGEST}}
190196
191197
attest:

‎.github/workflows/release.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,10 @@ jobs:
2222
steps:
2323
- name: Retrieve tag name
2424
if: ${{ startsWith(github.ref, 'refs/tags/') }}
25+
env:
26+
REF_NAME: ${{ github.ref_name }}
2527
run: |
26-
echo TAG_NAME=$(echo ${{ github.ref_name }}) >> $GITHUB_ENV
28+
echo "TAG_NAME=${REF_NAME}" >> "$GITHUB_ENV"
2729
- name: Get release ID from the release created by release drafter
2830
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
2931
with:

0 commit comments

Comments
 (0)